- Data recovery is the process of restoring data that has been lost, accidentally deleted, corrupted or made inaccessible.
- In computing, data recovery is a process of salvaging inaccessible, corrupted or damaged data from secondary storage, removable media or files, when the data they store cannot be accessed in a normal way.
- The data is most often salvaged from storage media such as internal or external hard disk drives (HDDs), solid-state drives (SSDs), USB flash drives, magnetic tapes, CDs, DVDs, RAID subsystems, and other electronic devices. Recovery may be required due to physical damage to the storage device or logical damage to the file system that prevents it from being mounted by the host operating system (OS).
The term “data recovery” is also used in the context of forensic applications or espionage, where data which have been encrypted or hidden, rather than damaged, are recovered.
In enterprise IT, data recovery typically refers to the restoration of data to a desktop, laptop, server or external storage system from a backup.
WHY OR HOW DATA LOSS OCCURS?
- Most data loss is caused by human error, rather than malicious attacks, according to U.K. statistics released in 2016. In fact, human error accounted for almost two-thirds of the incidents reported to the U.K. Information Commissioner’s Office. The most common type of breach occurred when someone sent data to the wrong person.
- Other common causes of data loss include power outages, natural disasters, equipment failures or malfunctions, accidental deletion of data, unintentionally formatting a hard drive, damaged hard drive read/write heads, software crashes, logical errors, firmware corruption, continued use of a computer after signs of failure, physical damage to hard drives, laptop theft, and spilling coffee or water on a computer.
HOW DATA RECOVERY WORKS?
- The data recovery process varies, depending on the circumstances of the data loss, data recovery software used to create the backup and the backup target media. For example, many desktop and laptop backup software platforms allow users to restore lost files themselves, while restoration of a corrupted database from a tape backup is a more complicated process that requires IT intervention. Data recovery services can also be used to retrieve files that were not backed up and accidentally deleted from a computer’s file system, but still remain on the hard disk in fragments
- Data recovery is possible because a file and the information about that file are stored in different places. For example, the Windows operating system uses a file allocation table to track which files are on the hard drive and where they are stored. The allocation table is like a book’s table of contents, while the actual files on the hard drive are like the pages in the book.
- When data needs to be recovered, it’s usually only the file allocation table that’s not working properly. The actual file to be recovered may still be on the hard drive in flawless condition. If the file still exists — and it is not damaged or encrypted — it can be recovered. If the file is damaged, missing or encrypted, there are other ways of recovering it. If the file is physically damaged, it can still be reconstructed. Many applications, such as Microsoft Office, put uniform headers at the beginning of files to designate that they belong to that application. Some utilities can be used to reconstruct the file headers manually, so at least some of the file can be recovered.
NOTE:– Most data recovery processes combine technologies, so organizations aren’t solely recovering data by tape. Recovering core applications and data from tape takes time, and you may need to access your data immediately after a disaster. There are also risks involved with transporting tapes.
DATA RECOVERY TECHNIQUES
- Instant recovery, also known as recovery in place, tries to eliminate the recovery window by redirecting user workloads to the backup server. A snapshot is created so the backup remains in a pristine state and all user write operations are redirected to that snapshot; users then work off the backup virtual machine (VM) and the recovery process begins in the background. Users have no idea the recovery is taking place, and once the recovery is complete, the user workload is redirected back to the original VM.
- Hardware repair:- A common misconception is that a damaged printed circuit board (PCB) may be simply replaced during recovery procedures by an identical PCB from a healthy drive. While this may work in rare circumstances on hard disk drives manufactured before 2003, it will not work on newer drives. Electronics boards of modern drives usually contain drive-specific adaptation data required for accessing their system areas, so the related componentry needs to be either reprogrammed (if possible) or unsoldered and transferred between two electronics boards.
FORMS OF DATA LOSS:-
- Data loss can take many forms — accidental deletion, hard drive failure, software bugs, data corruption, hacking, even a simple power failure can cause you to lose data. And, of course, there are more extreme cases, like when a hard drive is recovered from a plane crash; amazingly, some data recovery specialists can retrieve data from storage media that’s been almost completely destroyed.
- If a piece of data used to be on your hard drive, solid-state drive, USB stick, RAID, or other storage media, you might be able to hire someone (or purchase some software) to perform data recovery. Data recovery is, simply, the salvaging and repair of data that has been lost.
- Of course, data recovery won’t always be possible; sometimes a system can be too corrupted or damaged to get much of the data back. However, data-recovery technology has become extremely advanced; for example, Kroll On track, an Australian data recovery company, was able to recover 99% of the data from a hard drive that was on the Challenger space craft when it disintegrated upon re-entry.
MODES OF DATA RECOVERY?
The methods used to recover lost data depend on how the data was lost in the first place; let’s take a look at some of the most common forms here.
- File Deletion
- File Corruption
- File System Format or Damage
- Physical Drive Damage
- Solid State Drive Data Recovery
NOTE:- Your Best Bet: Don’t Lose Your Data
How Data can be recovered ?
- Data recovery software and specialists can do a great job of getting your data back, but it’s risky, time-consuming, and expensive. You can use paid or free data recovery software to recover your data back .The best measure you can take to prevent long-term data loss is the one we’ve been advocating for a long time: make lots of backups! Use a cloud backup provider, keep a backup hard drive in your home, and make sure you don’t get caught out by a power surge or an accidental formatting. And take steps to prevent file corruption in the first place.
Four phases of data recovery
Usually, there are four phases when it comes to successful data recovery, though that can vary depending on the type of data corruption and recovery required.
Phase 1: Repair the hard disk drive
Repair the hard disk drive so it is running in some form, or at least in a state suitable for reading the data from it. For example, if heads are bad they need to be changed; if the PCB is faulty then it needs to be fixed or replaced; if the spindle motor is bad the platters and heads should be moved to a new drive.
Phase 2: Image the drive to a new drive or a disk image file
When a hard disk drive fails, the importance of getting the data off the drive is the top priority. The longer a faulty drive is used, the more likely further data loss is to occur. Creating an image of the drive will ensure that there is a secondary copy of the data on another device, on which it is safe to perform testing and recovery procedures without harming the source.
Phase 3: Logical recovery of files, partition, MBR and file system structures
After the drive has been cloned to a new drive, it is suitable to attempt the retrieval of lost data. If the drive has failed logically, there are a number of reasons for that. Using the clone it may be possible to repair the partition table or master boot record (MBR) in order to read the file system’s data structure and retrieve stored data.
Phase 4: Repair damaged files that were retrieved
Data damage can be caused when, for example, a file is written to a sector on the drive that has been damaged. This is the most common cause in a failing drive, meaning that data needs to be reconstructed to become readable. Corrupted documents can be recovered by several software methods or by manually reconstructing the document using a hex editor.